IETF Logo Mail Archive

[SCITT] Re: Last Call: <draft-ietf-scitt-receipts-ccf-profile-04.txt> (CCF Profile for COSE Receipts) to Proposed Standard

Nicholas Templeman <nicholas@csoai.org> Sat, 29 August 2026 03:08 UTC

Return-Path: <nicholas@csoai.org>
X-Original-To: scitt@mail2.ietf.org
Delivered-To: scitt@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 6B7F0131554C1 for <scitt@mail2.ietf.org>; Fri, 28 Aug 2026 20:08:03 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1787972883; bh=hKrxAubKQOc2joUt/rddIGVhTGzcYlVIu1EUx67JmMI=; h=From:To:Cc:Subject:Reply-To:Date:In-Reply-To:References; b=w2br6l5r1fcty/AGPdnAId7qXR+MVLnNSAvgXZzmVSecSi18hjL/i/i/FfCWmQcVP +je1lmbrdGX2HRAye7g7lN6oHSbO5Rh0NnIje7537vpmb2wmJsCDuAg8CLvV9whNVW f0/RubBa2J4fdiQcfEeono7NSeDc78h0JpN4uTM4=
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -1.998
X-Spam-Level:
X-Spam-Status: No, score=-1.998 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=csoai.org
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id X2A5CrvS6UQp for <scitt@mail2.ietf.org>; Fri, 28 Aug 2026 20:08:03 -0700 (PDT)
Received: from out-93wp-a27.jellyfish.systems (out-93wp-a27.jellyfish.systems [104.207.68.27]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id DD45D131554B5 for <scitt@ietf.org>; Fri, 28 Aug 2026 20:08:02 -0700 (PDT)
Received: from mail.privateemail.com (unknown [104.28.239.170]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mail.privateemail.com (Postfix) with ESMTPSA id 4hX0Yj4B7Tz6tkK; Sat, 29 Aug 2026 03:07:53 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=csoai.org; s=default; t=1787972875; bh=hKrxAubKQOc2joUt/rddIGVhTGzcYlVIu1EUx67JmMI=; h=From:To:Cc:Subject:Reply-To:Date:In-Reply-To:References:From; b=o4et/+mixwZQjY/jdgyPGvAQ54tn1avF4WRhm7t4lDSUkl2pb5U4+QHb/+5jHh+5s RJk2kIe1EOZOX3D/1HvNHVvcQvwUD6BOU4s4nbyAemxaI6BHWJ5YTLA+yLpsS2quvj WwDrQ0gnfE9zFA+yRyHO854GvU3u6KIpG6j7YRlURu+dpMp0l+3YoXpATp86iwvGRq 203JnuowTzX+Cqs7219STmIsM8wzpM/w5+QVdTQm3U3ky7q8VVg08PDFUrb3zG4IIP LziyyBQbTEVV+7l+Ye85w5gB+Zo5m3og+M9c9p6xc6J4+Pdy88mn0UBkbFQZMB6HEE GBEZtZ98Vp2GA==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
From: Nicholas Templeman <nicholas@csoai.org>
To: last-call@ietf.org
Date: Sat, 29 Aug 2026 04:07:53 +0100
Message-ID: <178797287324.36260.35312539657941429@csoai.org>
In-Reply-To: <178758708473.444565.405251455206578612@dt-datatracker-786f84c586-vck88>
References: <178758708473.444565.405251455206578612@dt-datatracker-786f84c586-vck88>
X-Envelope-From: nicholas@csoai.org
Message-ID-Hash: LRBOIHMGD4TBRMTU35XH67BX3E2HY633
X-Message-ID-Hash: LRBOIHMGD4TBRMTU35XH67BX3E2HY633
X-MailFrom: nicholas@csoai.org
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: scitt@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Reply-To: Nicholas Templeman <nicholas@csoai.org>
Subject: [SCITT] Re: Last Call: <draft-ietf-scitt-receipts-ccf-profile-04.txt> (CCF Profile for COSE Receipts) to Proposed Standard
List-Id: "Supply Chain Integrity, Transparency, and Trust" <scitt.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/scitt/ETVUZjsZ8XgkWR2XUW5oMexkdug>
List-Archive: <https://mailarchive.ietf.org/arch/browse/scitt>
List-Help: <mailto:scitt-request@ietf.org?subject=help>
List-Owner: <mailto:scitt-owner@ietf.org>
List-Post: <mailto:scitt@ietf.org>
List-Subscribe: <mailto:scitt-join@ietf.org>
List-Unsubscribe: <mailto:scitt-leave@ietf.org>

I have no objection to publication of -04 as Proposed Standard.

One implementation-experience note, not a blocking issue: the MUST
that the Merkle-root payload is detached (so verifiers recompute the
root from the inclusion proof) is the right safeguard. A second,
independently-built verifier is only meaningful if it cannot "succeed"
by trusting a supplied root.

I did not review the CCF-internal leaf fields beyond the document's
statement that receipt verifiers may ignore them. This note is about
RFC 9162-shaped logs and COSE Receipts (RFC 9942), not a CCF run.

Nicholas Templeman
Council of AI
nicholas@csoai.org

v2.46.0 | Report a Bug | By Email | System Status